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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



\ 
EDMUND C. SCARBOROUGH, 

6850 CR Road 544 East 
Haines City, Florida 33845, 

DR. LARRY J. WRIGHT, 

4304 Hollygate Drive 
Jacksonville, Florida 32258, 

and 

GEORGE GOWEN, 

1982 Evening Star Drive 
Park City, Utah 84060, 

Plaintiffs, 

V. Case No.: 05-CV-0 1427 

(Judge Reggie B. Walton) 
Francis J. Harvey, Secretary of the Army, 
UNITED STATES DEPARTMENT OF 
THE ARMY, 

Serve: 

United States Department of the Army 

Litigation Division 

JALS-LT 

901 N. Stuart Street, Suite 400 

Arlington, VA 22203-1837, 

Donald H. Rumsfeld, Secretary of Defense, 
UNITED STATES DEPARTMENT OF 
DEFENSE, 

Serve: 

United States Department of Defense 

Office of General Counsel 

1600 Defense Pentagon 

Washington, DC 20301-1600, 

and 

Hector V. Barreto, Administrator, 
UNITED STATES SMALL 
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BUSINESS ADMINISTRATION, 

Serve: 

United States Small Business 

Administration 
Office of the General Counsel 
409 Third Street S.W. 
Washington, DC 20416, 

Defendants. 

/ 



AMENDED COMPLAINT FOR VIOLATIONS 
OF THE PRFVACY ACT, 5 U.S.C. § 552a 

Plaintiffs Edmund C. Scarborough, Dr. Larry J. Wright, and George Gowen, through 
counsel, sue the Defendants United States Department of the Army, United States Department of 
Defense, and the United States Small Business Administration for violations of the Privacy Act, 
5 U.S.C. § 552a. Plaintiffs seek actual damages, compensatory damages and attorneys' fees and 
costs from the Defendants as a result of the harms caused by Defendants' intentional and/or 
willful and unlawful behavior. 

PARTIES 

1. Plaintiff, Edmund C. Scarborough ("Scarborough"), is an individual surety 
providing surety bonds to contractors performing commercial and government construction 
contracts, separately serves as Co-Chief Executive Officer of International Bonding & 
Construction, Inc. ("IBCS"), is a citizen of the United States, and resides in Haines City, Florida. 
IBCS is in the business of providing a variety of bonding and construction 
administration/consulting services to Scarborough and other individuals and entities. 

2. Plaintiff, Dr. Larry J. Wright ("Wright") is President of The Underwriters Group 
("UG"), is a citizen of the United States, and resides in Jacksonville, Florida. At all times 
material Wright was and is engaged in the business of risk underwriting for business, 
construction and financial institutions. 
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3. Plaintiff, George Gowen ("Gowen") is the President of First Mountain Bancorp 
("FMB"), is a citizen of the United States, and resides in Park City, Utah. FMB is a Nevada 
corporation with its principal place of business located in Las Vegas, Nevada and which at all 
times material was and is engaged, inter alia, in the business of serving as trustee for investors. 

4. Defendant Francis J. Harvey is the Secretary of the Army. The United States 
Department of the Army ("DA") is an agency of the United States Government. Defendant DA 
has a Criminal Investigation Division ("CID") described in DA regulations as the "sole agency 
within the United States Army responsible for the investigation of felonies . . . ." Pursuant to DA 
regulation, CID has investigative authority whenever an Army interest exists and investigative 
authority has not been specifically reserved to another agency. 

5. Defendant Donald Rumsfeld is the Secretary of Defense. The United States 
Department of Defense ("DoD") is an agency of the United States Government. 

6. Defendant Hector V. Barreto is the Administrator of the United States Small 
Business Administration ("SBA"), an agency of the United States Government. Defendant 
SBA's address is 409 Third Street, S.W., Washington, DC 20416. 

JURISDICTION AND VENUE 

7. This Court has jurisdiction pursuant to 5 U.S.C. §§ 552a(g)( 1) and (g)(5) of the 
Privacy Act that establish jurisdiction over violations in the District Courts of the United States. 

8. Venue is proper in the District of Columbia pursuant to 5 U.S.C. § 552a(g)(5). 

STATEMENT OF FACTS 
Background Facts 

9. Plaintiff Scarborough acts as an individual surety on bid, payment and 
performance bonds given to various agencies of the United States Government (hereinafter 
referred to as "Government") and to private owners and contractors. Plaintiff Wright as 
President of The Underwriters Group is in the business of risk underwriting for business. 
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construction, and financial institutions, and locates monies to guarantee investors against losses. 
Plaintiff Gowen gathers assets to back and/or guaranty the individual surety bonds, and acts as 
trustee of assets backing the same. 

10. When Plaintiff Scarborough furnishes bid, payment and performance bonds to the 
Government, as obligee, he provides a financial instrument known as an Irrevocable Trust 
Receipt ("ITR") to document the existence of specific marketable assets that are pledged as 
collateral to guarantee the performance of a bond obligation. The assets are held in a federally 
insured financial institution. ITRs are issued by many recognized financial institutions, are 
utilized in various industries or lines of business, and are accepted by local. State and Federal 
government agencies for a variety of purposes. 

11. In the context of Plaintiffs' businesses, ITRs evidence the existence of specific 
marketable assets pledged in support of bid, performance and/or payment bonds and guarantee a 
Federal contractor' s performance of a Government construction project. The assets are held in a 
trust, with Plaintiff Gowen serving as trustee. 

12. Upon information and belief, in or about March 2004, Special Agent 
Christopher C. Hamblen ("SA Hamblen") of Defendant DA's Criminal Investigation Division 
("CID") began investigating allegedly fraudulent and/or criminal acts by a third party, Robert Joe 
Hanson ("Hanson"), in the issuance of individual surety bonds to the United States Government. 

13. Upon information and belief, SA Hamblen, upon learning of Plaintiffs' 
involvement in the individual surety and collateral businesses and/or their use of ITRs, 
incorrectly concluded that Plaintiffs were engaged in issuing false or fraudulent bonds and/or 
pledging speculative assets to back the same. 

14. SA Hamblen is not a contracting officer with a warrant as that term/position is 
defined in the Federal Acquisition Regulation ("FAR"), 48 C.F.R. Parts 1-53. Despite this, he 
determined that ITRs do not meet the definition of acceptable assets at FAR 28.203-2. 

SA Hamblen is mistaken. A number of contracting officers and their counsel for Federal and 
local governments have reviewed the individual surety bonds offered by Mr. Scarborough and 
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backed by assets identified by George Gowen, as well as the underlying assets supporting the 
ITRs, have determined that they meet the requirements of the FAR, and have accepted the same 
on government contracts. 

15. In or about March 2005, despite the lack of any evidence of criminal wrongdoing 
by Plaintiffs, SA Hamblen created and issued a "Criminal Alert Notice" (CAN) numbered 0006- 
04-CID274 naming Plaintiffs and related entities. The CAN, despite accusations of false bonds, 
cites no evidence and makes no charges against Plaintiffs. 

DA and CID Failed to Follow Their Own Regulations Governing Criminal 

Alert Notices, Procurement Fraud Policies/Procedures, and Disclosure and 

Dissemination of Investigative Information 

16. According to CID Regulations supplementing DA Regulations, a CAN is one of 
two mutually exclusive types of intelligence reports issued by CID. The second is the Criminal 
Intelligence Report (CIR). 

17. The purpose of a CAN is to expedite the reporting of perishable {i.e., 
time- sensitive) crime-related information to organizations external to CID in order to avoid 
victimization by the suspect(s) of "high risk activities" within the DA which would degrade the 
DA's mission. The use of a CAN presupposes that a crime has been committed or is being 
committed, and that a suspect has been identified. A CAN is to include specific items of 
information such as known aliases, exact crime committed, a summary of all pertinent 
information on the suspect, and recommended actions. Examples of information to be reported 
in a CAN include serial crime, criminal fraud schemes, bad checks and impersonators. 

18. The CIR is to be used for disseminating non-time- sensitive or non-imminent 
criminal information, such as crime patterns, new methods of operation and modern technology 
being used by criminals. A number of checks and balances have been built into the procedures 
for issuance of a CIR to assure that proper protection is afforded to individuals who are the 
subjects of an investigation. 
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19. The purpose for, and common uses of, CANs and CIRs do not include non- 
emergency communications regarding suspected procurement fraud to DoD contracting offices. 
For this purpose, DA and CID Regulations establish a different "vehicle" - the "Procurement 
Flash Report" (PFR). 

20. DA Regulations also establish the Procurement Fraud Division (PFD) of the U.S. 
Army Legal Services Agency, a unit of the Office of the Judge Advocate General (OTJAG), as 
the single centralized organization in the DA to coordinate and monitor criminal, civil, 
contractual, and administrative remedies in significant cases of fraud relating to DA 
procurement. Thus, the PFD of the OTJAG, and not CID, is the office of primary responsibility 
for procurement fraud issues. Under this organizational structure, reports of significant cases of 
procurement fraud or suspected procurement fraud are supposed to flow, by means of a PFR, 
from law enforcement and contracting offices, through a unit Procurement Fraud Advisor 
("PFA") to the PFD of the OTJAG. 

21. While CID plays a role in the investigation of suspected procurement fraud under 
the oversight of the PFD, and may share criminal investigation information with other law 
enforcement agencies and, under certain limited circumstances, with persons outside law 
enforcement, pursuant to DA and CID Regulations the CID's ability to disclose information is 
limited to those persons whose official duties create a definite and identifiable need for them to 
have access. 

22. As to disclosure of procurement fraud and other investigative information by CID 
to other law enforcement agencies, dissemination of such information outside CID channels is to 
be made only when that information provides strong indications that an offense is imminent and 
the commission of that offense will affect the safety or security of DA operations, personnel or 
material. Release to other law enforcement agencies is to be made only to the extent necessary to 
prevent the commission of the offense. 

23. In the case of dissemination of procurement fraud and other investigative 
information by CID outside law enforcement channels, the Army Regulations' restrictions are 
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even tighter. Dissemination must be made to the minimum number of persons possible and in 
accordance with the Privacy Act and the DA Regulations implementing the Privacy Act. 
Specifically, derogatory information that mentions or can be tied to particular individuals will be 
released only to those persons whose official duties create a definite need to have access to that 
information. 

24. Pursuant to DA Regulations, CID may send notifications of suspected 
procurement fraud to other military components (e.g.. Navy, Air Force) but only to the other 
components' criminal investigative organization and not other components contracting officers. 

25. Pursuant to DA Regulations, the "For Official Use Only" ("FOUO") designation 
is reserved for information that has not been given a security classification but which may be 
withheld from the public because disclosure would cause a foreseeable harm to an interest 
protected by one or more Freedom of Information Act ("FOIA"), 5 U.S.C. § 552, exemptions. 
One of those interests is a clearly unwarranted invasion of privacy under Exemption 6 of the 
FOIA. 

SA Hamblen's CAN Failed to Meet the "For Official Use Only"and Privacy 

Act Requirements, Exceeded His and CID's Jurisdiction and Investigative 

Authority, and Utilized the Wrong Method of Communication 

26. SA Hamblen addressed and issued the CAN to "ALL DoD CONTRACTING 
OFFICES." SA Hamblen marked the CAN as containing "FOR OFFICIAL USE ONLY" 
("FOUO") information, indicating the sensitive and confidential nature of the personal 
information contained therein. Therefore, as a FOUO document, the CAN was not releasable to 
the public. 

27. SA Hamblen's CAN is titled "Insurance Fraud - Bonding and Surety", and begins 
by stating that "[t]he following individual [sic] and entities have been selling and advertising 
surety bonds to construction companies . . . ." The CAN goes on to name, inter alia and without 
any specific link to criminal activity. Plaintiff Scarborough, IBCS, Plaintiff Wright, UG, Plaintiff 
Gowen, and FMB. 
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28. The text of the CAN describes the alleged fraudulent and criminal activities of 
Hanson, and in doing so mentions Plaintiffs and related entities as though they are or were 
committing fraudulent and criminal activities in concert with Hanson. 

29. SA Hamblen's CAN also contains personal, sensitive and Privacy Act-protected 
information regarding Plaintiffs Scarborough, Wright and Gowen. 

30. Regarding Plaintiff Scarborough, the CAN contains personal and confidential 
information about him including, but not limited to, Mr. Scarborough's name, financial history, 
associations, entrepreneurial activities, communications with contracting officers, business 
interests and business addresses. 

3 1 . Regarding Plaintiff Wright, the CAN contains personal and confidential 
information about him including, but not limited to. Dr. Wright's name, prior investigations into 
his activities (including specific investigation case reference numbers), financial history, 
associations, entrepreneurial activities, business interests and business addresses. 

32. Regarding Plaintiff Gowen, the CAN contains personal and confidential 
information about him including, but not limited to, Mr. Gowen' s name, financial history, 
associations, entrepreneurial activities, business interests and business addresses. 

33. Much of the information about Plaintiffs in SA Hamblen's CAN is inaccurate, 
misleading, or false, and in no way relates to their current businesses or Plaintiff Scarborough's 
issuance of individual surety bonds, or has any relationship to any matter being investigated, as 
admitted by Curtis L. Greenway ("Greenway"), Legal Advisor to the Major Procurement Fraud 
Unit of CID, in his letter of May 6, 2005. 

34. In contravention of Army and CID regulations discussed above, SA Hamblen's 
CAN exceeded his and Defendant DA' s jurisdiction and investigative authority, utilized the 
wrong communication method {i.e., a CAN versus a PFR), sidestepped the PFD, disclosed law 
enforcement information to persons whose official duties did not create a definite and 
identifiable need for them to have access, was issued in the absence of any indication that an 
offense was imminent, was issued to far more individuals than necessary to prevent the 

8 
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commission of any offense, was sent to more than just the criminal investigative organization(s) 
of other military components, and violated the restrictions against release of FOUO information. 

35. SA Hamblen did not act solely on his own. Defendant DA knew or should have 
known what SA Hamblen was doing at all times relevant. 

36. The CAN, and the information contained therein, is a "record", as that term is 
defined by 5 U.S.C. § 552a(a)(4), or was derived from such a "record". Furthermore, the CAN 
identifies Plaintiffs by name; and, was maintained by Defendant DoD in a "system of records," 
as that term is defined by 5 U.S.C. § 552a(a)(5). 

DA's Improper Disclosures of Plaintiffs' Privacy Act-Protected Information 

DA's Disclosure of the CAN to the National Association of Surety Bond Producers 

37. In or about late March 2005, Defendant DA, through its agent, SA Hamblen, 
disclosed and disseminated the CAN to the National Association of Surety Bond Producers 
("NASBP"), an international organization of professional surety bond producers and brokers 
representing over 5,000 persons specializing in surety bonding, providing performance and 
payments bonds for the construction industry, and issuing other types of surety bonds for 
guaranteeing performance, such as license and permit bonds. Defendant DA's disclosure was in 
contravention of CID and Army regulations and procedures, the requirements related to FOUO 
information, and the Privacy Act. 

38. In or about April 2005, the NASBP published a copy of the CAN in the 
April/May edition of its Pipeline newsletter explicitly citing SA Hamblen as the source of the 
CAN, stating: "NASBP recently received a Criminal Alert Notice (CAN) from Special Agent 
Chris C. SA Hamblen with the DA Criminal Investigation Command (CID) out of Phoenix, 
AZ " 

39. Upon information and belief, the Pipeline article was published in electronic 
form, on the NASBP' s website at www.nasbp.org , as well as in hard copy form. A copy of the 
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CAN was accessible to NASBP members via a link in the electronic Pipeline article as well as to 
any reader of the hard copy article that included a copy of the CAN as an attachment. 

40. Asa result of S A Hamblen' s and DA' s unauthorized dissemination of the CAN to 
NASBP which, in turn, disseminated the CAN to its 5,000 or more members. Plaintiffs suffered 
financial losses and harm to their business and personal reputations. 

DA's Disclosure of the CAN to the DoD's Defense Acquisition University ("DAU") 

41. In or about late March 2005, Defendant DA, through its agent SA Hamblen, 
separately disclosed and disseminated the CAN, directly or indirectly, to the Defense Acquisition 
University ("DAU"), an agency of the DoD. The DAU describes itself on its website as "a 
premier corporate university serving the DoD [Acquisition, Technology, and Logistics] 
workforce . . . ." 

42. DAU is not a law enforcement agency of DoD, and has no interest in or need to 
know the information in the CAN. 

DA's Disclosure of the CAN to Other DoD Agencies 

43. In or about late March 2005, and as stated on the CAN itself, SA Hamblen also 
disclosed and disseminated the CAN to all DoD contracting offices in violation of DA and CID 
Regulations. 

44. Specifically, on Wednesday, March 23, 2005, SA Hamblen sent the CAN via 
e-mail to Air Force Lieutenant Colonel Vincent J. Feck ("Lt Col Feck"), Director of Operations, 
Defense Procurement & Acquisition Policy, with a request that Lt Col Feck disseminate the 
CAN to "all DoD contracting Offices." Contracting offices are not law enforcement agencies 
and have no need to know the information in the CAN, and disclosure to them is not a routine 
use of a CAN or any related system of records. 

DA's Disclosure of Other Privacy Act-Protected Information to First Bank 

45. The DA's latest known disclosure is SA Hamblen's June 21, 2005 letter from him 
to Chris Troublstead at the Fraud Prevention/Investigation Division of First Bank in Creve 
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Coeur, Missouri. The subject of the letter is "Request for Authentication/Information." Id. The 
June 21, 2005 letter, and the information contained therein, is a "record", as that term is defined 
by 5 U.S.C. § 552a(a)(4), or was derived from such a "record". Furthermore, the June 21 letter 
identifies Plaintiffs by name; and, was maintained by Defendant DA in a "system of records," as 
that term is defined by 5 U.S.C. § 552a(a)(5). 

46. In the June 21 letter, SA Hamblen states to First Bank that his office is 

currently conducting an investigation on fraudulent surety bonds, which are [sic] 
submitted on US Government construction contracts (Bid, Performance, and 
Payment Bonds). This investigation has established/revealed subjects of this 
ongoing investigation could be associating themselves with the name of your 
organization/business "FIRST BANK." The subjects of this investigation are 
currently relating they have an account with "FIRST BANK" and the assets 
behind their fraudulent bonds, [sic] are being held in an escrow account at 
"FIRST BANK" (certificate number is 12229) through an "Irrevocable Trust 
Receipt". 

2. This office is concerned this claim and the assets could be false, created to 
harm Federal and State governments, as well as the civilian population. This 
office is not looking for any documentation at this time, but would like to simply 
confirm/authenticate if your organization has a legal/authentic association with 
the identified business and individuals. ... If your financial institution does not 
have a [sic] association with the individual sureties, the bonds they have 
submitted to the U.S. Government would be fraudulent, putting the government at 
risk when either the contractor or the government go to use the bonds. 

Id. 

47. The referenced ITR is included as Attachment 1 to SA Hamblen's June 21 letter. 
Id., second page. The ITR is one issued by Plaintiff Gowen naming as a beneficiary the United 
States Department of Agriculture, Agricultural Research Service (hereafter "Department of 
Agriculture"). Attachment 2 to SA Hamblen's letter is a June 14, 2005 letter by Plaintiff Gowen 
to the contractor or potential contractor to the Department of Agriculture. Id., third page. 

48. In his June 21, 2005 letter, SA Hamblen mischaracterizes the scope of his 
authority, implying that he was conducting a Government- wide investigation rather than an 
Army investigation. He did so with the intention of obtaining information or records concerning 
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financial activities of Plaintiffs to which he was not entitled. SA Hamblen also stated that 
Plaintiffs "are currently being investigated by this office for fraudulent surety bonds and the 
assets that back those bonds." He also stated that the underlying "assets could be false, created 
to harm Federal and State governments, as well as the civilian population." 

49. Defendant DA has no authority or jurisdiction to investigate crimes or potential 
crimes against the Department of Agriculture or any other non-DA agency. Thus, the financial 
records and/or information derived therefrom requested and obtained by SA Hamblen do not and 
cannot have any reasonable connection with the subject matter of SA Hamblen's investigation 
and, thus, evidence intentional and/or willful intent in releasing such information. 

50. Attachment 3 to SA Hamblen's June 21 letter contains a list described as "the list 
of subjects (individuals and businesses) that are currently being investigated by this office for 
fraudulent surety bonds and the assets that back those bonds, (names under each company are 
the people associated with the company)". Id., seventh page. The list includes the names of all 
Plaintiffs and their businesses (except that UG's name is wrongly identified). 

51. The list also gratuitously names approximately 27 other individuals and/or entities 
that were not named in the CAN and many of who are not involved as part of, or related in any 
way to. Plaintiff Scarborough's individual surety program. For instance, the list includes the 
certified public accounting firm, Daniel K. Anderson, LTD, that independently valued the assets 
underlying the Department of Agriculture bond. 

52. At some point in time after he sent the June 21 letter to First Bank's Fraud 
Prevention/Investigation Division, SA Hamblen contacted Al Powell, Vice President of First 
Bank's Clayton, Missouri branch by telephone and verbally requested information from, and/or 
access to. First Bank financial records regarding the existence, nature and extent of any bank- 
customer relationship between First Bank and one or more of Plaintiffs herein. 

53. During SA Hamblen's conversation with Powell of First Bank, Powell asked 
Mr. Hamblen two direct questions: 1) "Should First Bank close the account?"; and 2) "Is 

Mr. Hamblen saying that the assets First Bank is holding are fraudulent?" or words to that effect. 

12 
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Mr. Hamblen coyly answered that "it was up to First Bank" or words to that effect, creating the 
impression that the answer to both questions was "yes" but that he chose not to say this directly. 

54. As a result of Mr. Hamblen's actions, First Bank refused to do one deal with 
Mr. Gowen that would have allowed him to earn many millions of dollars per month for 
twelve (12) months. First Bank later terminated its relationship and contract with Mr. Gowen, 
forcing Mr. Gowen to find a new financial institution to maintain the escrow account containing 
approximately $540,000,000. As a result, and during the time required to transfer the escrow 
account. Plaintiffs lost several business opportunities and in other ways First Bank's actions 
impacted Plaintiffs' individual surety program and collateral businesses. 

DoD's Improper Disclosures of Plaintiffs' Privacy Act-Protected Information 

DoD's Disclosure of the CAN to the Public Via The DAU Website 

55. In or about April 2005, DAU published a copy of the CAN, containing personal 
and confidential information about Plaintiffs and marked "FOR OFFICIAL USE ONLY," on its 
public website, allowing any member of the public accessing its website to access and view the 
CAN in its entirety. 

56. Upon information and belief, no one at DAU or anyone else at DoD made an 
independent inquiry into the CAN or the facts therein, despite having a duty to verify or ascertain 
that the information in the CAN was correct before disseminating it. 

57. The public DAU website page containing the CAN was, in fact, accessed and 
viewed over 150 times by internet users. 

58. On June 9, 2005, Scarborough's counsel notified Frank J. Anderson, Jr. 
("Anderson"), President of DAU, and Michele Parchman ("Parchman"), General Counsel for 
DAU, of DAU' s unauthorized disclosure of the CAN, including the "FOR OFFICIAL USE 
ONLY" and personal information contained within, on its website. Scarborough's counsel also 
notified DAU of the further unauthorized disclosures by third parties occurring as a result of 
DAU's public posting of the CAN. 
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59. On or about June 13, 2005, and within 24 hours of receiving Plaintiff's letter 
claiming Privacy Act violations by DAU, DAU removed the CAN from its publicly available 
website and/or made it a password protected item on its website. 

DoD's Disclosure of the CAN to Other Government Agencies 

60. On and after March 31, 2005, Defendant DoD, through its agent Lt Col Feck and 
and others further disclosed and disseminated the CAN via e-mail to all DoD Senior 
Procurement Executives (instructing them to disclose and disseminate the CAN to all DoD 
contracting officers), and other Government agencies and employees, including but not limited to 
Stephen G. Smith ("Smith"), Director of Contracting at Brooks City-Base, Texas. 

61. On April 1, 2005, Defendant DoD, through its employee Smith, disclosed and 
disseminated the CAN via e-mail to various persons at Brooks City-Base including, but not 
limited to, Mary S. Urey ("Urey"), Director of Small Business. On information and belief, 
Ms. Urey is an employee or agent of the DoD. 

62. These disclosures by Defendant DoD to other DoD entities and Government 
agencies were in contravention of Army and CID regulations discussed above, were made to 
persons whose official duties did not create a definite and identifiable need for them to have 
access, were made in the absence of any indication that an offense was imminent, were made to 
far more individuals than necessary to prevent the commission of any offense, were sent to more 
than just the criminal investigative organization(s) of other military components, and violated the 
restrictions against release of FOUO information. 

DoD's Disclosure of the CAN to SB A 

63. On April 1, 2005, Defendant DoD, through its employee Urey disclosed and 
disseminated the CAN via e-mail to Ann H. Montes ("Montes") of the United States Small 
Business Administration ("SBA") and other SBA personnel. SBA personnel subsequently 
disclosed the CAN with its accusations of fraud against Plaintiffs to numerous people and 
organizations outside the Government. 
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64. SBA is not a law enforcement or other agency of the DA or DoD, and has no need 
to know the information in the CAN. Disclosure to the SBA is not a routine use of a CAN or any 
related system of records. 

The SBA's Disclosures of Privacy Act Protected Information 

65. On April 4, 2005, Defendant SBA, through its agent Montes and/or other agents, 
disclosed and disseminated the CAN via e-mail to Fernando J. Guerra ("Guerra"), another 
employee and agent of Defendant SBA. 

66. On April 5, 2005, Defendant SBA, through its agent Guerra, disclosed and 
disseminated the CAN via e-mail to private contractors. Plaintiffs' competitors, and other 
unauthorized persons. None of these individuals or entities are employees or agents of the SBA 
or any other government agency. Upon information and belief, these individuals and entities 
further disclosed the CAN to an unknown number of third parties. 

67. Upon information and belief. Defendant SBA made no independent inquiry into 
the CAN or the facts therein, despite having a duty to verify or ascertain that the information in 
the CAN was correct before disseminating it. 

Plaintiffs' Notifications to Defendants DA and DoD of Privacy Act Violations 
and Attempts To Obtain Administrative Relief Were to No Avail As Neither 

Defendant Took Action 

68. Although the Privacy Act does not require exhaustion of administrative remedies, 
on April 7, 2005, Scarborough, through counsel, requested assistance and correction from Major 
General Donald Ryder ("MG Ryder"), Provost Marshal General of the Army and Commanding 
General Army Criminal Investigation Command (i.e., CID), notifying him and CID of the factual 
inaccuracies and erroneous conclusions contained in the CAN, explaining the personal financial 
emergency caused by the disclosure of the CAN and the personal information contained therein, 
and notifying him of the apparent malicious motives of SA Hamblen in disseminating the CAN. 
To date. Plaintiffs have received no response from MG Ryder. 
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69. On April 14, 2005, after having found no DA regulation addressing CANs, 
Plaintiff Scarborough, through counsel and pursuant to the FOIA, requested all policies, 
regulations, instructions, standard operating procedures, and other DA or CID publications or 
documents establishing, requiring, authorizing, regulating or in any way related to Criminal Alert 
Notices or their use. To date. Plaintiff Scarborough has received no response from CID 
although, in response to a similar request by Plaintiff Wright's counsel, CID sent a portion of the 
CID Regulation addressing CANs to Plaintiff Wright. 

70. On April 20, 2005, Plaintiff Scarborough, through counsel and pursuant to CID 
Regulations, requested that Philip McGuire ("McGuire"), Director of the United States Army 
Crime Records Center, provide access to and amendment of relevant CID reports regarding 
Scarborough. Specifically, Scarborough requested access to certain military police and criminal 
investigative reports, amendment of certain CID reports of investigation, removal of certain 
names for the title blocks of certain CID reports of investigation, and retracting of the CAN and 
correction of information contained therein. Scarborough requested expedited processing of his 
formal request due to the continuing harm suffered by him and IBCS as the CAN, containing 
both personal and false information, continued to be disseminated by CID to unauthorized 
parties. To date. Plaintiffs have received no response from McGuire or CID. 

71. On April 20, 2005, Scarborough, through counsel, sent a letter to Greenway 
requesting a meeting and action by CID regarding the apparent unauthorized disclosure of 
personal information contained in the CAN, citing the factual errors in the CAN, SA Hamblen's 
obvious misunderstanding of the ITR and underlying financial transactions, and the many 
procedural violations committed by SA Hamblen in creating and disseminating the CAN and the 
personal information contained therein. 

72. On April 2 1 , 2005, Plaintiff Wright, through counsel and pursuant to the FOIA, 
requested all policies, regulations, instructions, standard operating procedures, and other DA or 
CID publications or documents establishing, requiring, authorizing, regulating or in any way 
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related to CANs or their use. CID eventually released a copy of the paragraph of a certain CID 
Regulation addressing the issuance and proper uses of CANs but only to Plaintiff Wright. 

73. On April 21, 2005, Plaintiff Wright, through counsel, wrote to Greenway of CID 
protesting issuance and disclosure of the CAN and notifying CID that the CAN contains multiple 
errors of fact (many of which were specifically identified for CID in the letter), is replete with 
insinuations and veiled suggestions of wrongdoing without explanation, and draws conclusions 
that only contracting officers (and not investigators) are authorized to make. Counsel for 
Plaintiff notified CID that the multiple deficiencies inherent in the CAN and the process could 
only mean that SA Hamblen was acting with the specific intent to hinder his clients' business 
and malign them. Counsel for Plaintiff Wright also notified CID that Wright and UG had been 
damaged and that SA Hamblen's precipitate action in widely disseminating the CAN effectively 
suspends, if not debars, his clients from any opportunity to support investors and asset holders 
participating in federal construction contracts. 

74. On April 25, 2005, Greenway, who is also not a contracting officer under the 
FAR, purported to respond to Plaintiff Scarborough's April 20, 2005 letter by requesting 
clarification regarding the use of an ITR as backing for a surety bond and the role and nature of 
Plaintiff FMB, without addressing any of the substantive requests of the April 20 letter. To the 
extent he was involved directly or oversaw SA Hamblen, he permitted the issuance of the CAN 
while admitting that he did not understand the financial instruments involved and was not 
accusing Plaintiffs of criminal acts. 

75. On May 4, 2005, Scarborough's counsel responded with further information on 
ITRs and examples of government procurement contracts that have been backed by bonds 
supported by ITRs. Further, Scarborough provided FMB's articles of incorporation, FMB's 
hsting with the Defense Logistics Agency Central Contractor Registry, and FMB's DUNS 
Number, information that was obviously available to Greenway as a DoD employee yet was 
requested by Greenway of Scarborough. Again, Scarborough requested action regarding the 
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disclosure of the personal information contained within the CAN and redress of the factual errors 
contained therein, all of which were continuing to cause him and IBCS harm. 

76. On May 6, 2005, Greenway wrote to Plaintiff Wright's counsel including certain 
confidential, sensitive and Privacy Act-protected information about Plaintiff Wright. The May 6, 
2005 letter, and the information contained therein, is a "record", as that term is defined by 

5 U.S.C. § 552a(a)(4), or was derived from such a "record". Furthermore, the May 6 letter 
identifies Plaintiff Wright by name; and, was maintained by Defendant DA in a "system of 
records," as that term is defined by 5 U.S.C. § 552a(a)(5). As justification for SA Hamblen's 
disclosure of the CAN, and his and CID's refusal to act, Greenway opined that DoD contracting 
officers would want to know such confidential, sensitive and Privacy Act-protected information 
about Plaintiff Wright. The information had nothing to do with Wright' s current business or the 
investigation purportedly being made by SA Hamblen. 

77. In violation of the Privacy Act, Greenway' s May 6, 2005 letter also revealed 
confidential, sensitive and Privacy Act-protected information about Plaintiff Scarborough to 
Plaintiff Wright and counsel for Plaintiff Wright. The information had nothing to do with 
Scarborough's serving as an individual surety or his qualifications to do so. 

78. On May 13, 2005, counsel for Scarborough, having received no response to either 
his April 14 or April 20 letters, again requested available records and materials and reiterated 
Scarborough's request for access to and amendment of the CAN and related documents. To 
date. Plaintiffs have received no response from McGuire or CID. 

79. On May 16, 2005, Greenway responded to Scarborough's counsel's May 4 and 
May 16, 2005 letters stating: "We do not plan to rescind the Criminal Alert Notice". To the 
contrary, Greenway threatened to "supplement the notice" by providing all DoD contracting 
officers with additional confidential, personal and Privacy- Act protected information regarding 
Scarborough. The May 16, 2005 letter, and the information contained therein, is a "record", as 
that term is defined by 5 U.S.C. § 552a(a)(4), or was derived from such a "record". Furthermore, 
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the May 16 letter identifies Plaintiff Scarborough by name and was maintained by Defendant DA 
in a "system of records," as that term is defined by 5 U.S.C. § 552a(a)(5). 

80. In violation of the Privacy Act, Greenway's May 16, 2005 letter also revealed 
confidential, sensitive and Privacy Act-protected information about Plaintiff Wright to Plaintiff 
Scarborough and counsel for Plaintiff Scarborough. The information had nothing to do with 
Wright's business. 

81. In or about the first week of June 2005, Scarborough's counsel contacted 
McGuire's office by telephone and left a message for him seeking the status of the information 
and other requests. To date. Plaintiffs have received no response from McGuire or CID. 

82. On June 10, 2005, having received no response from McGuire other than a form 
FOIA response letter and blank Privacy Act waiver form, which Scarborough promptly 
completed and returned to CID, Scarborough's counsel provided supplemental information 
supporting Scarborough's position. Counsel reiterated his April 7, April 14, and April 20, 2005 
written requests and the phone message in the first week of June. Counsel for Scarborough 
further noted that McGuire had failed to timely respond to Scarborough's FOIA request despite 
the fact that McGuire had responded to Wright's essentially identical FOIA request. 

83. On June 13, 2005, DAU responded to Plaintiffs' counsel in writing, stating that it 
would remove the CAN from the public portion of its website. It did so but its actions were too 
late to have stopped public dissemination of Privacy Act-protected information. 

84. At no time did Defendants give Plaintiffs any prior notice or an opportunity to 
protest or otherwise protect any of the information contained within the records from third 
parties before making the above-described intentional and/or willful disclosures, and at no time 
did Plaintiffs give Defendants consent to make any of the above-described disclosures. The 
above-described intentional and/or willful releases by Defendants of the contents of records 
maintained in a system of records pertaining to Plaintiffs were not consistent with the purpose(s) 
for which the information was originally collected. 
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Plaintiffs Suffered Damages As a Result of Defendants' Issuance and 
Dissemination of the CAN and Other Privacy Act Violations 

85. Since the Defendant DA's issuance of the CAN, and as a direct result of 
Defendants' multiple violations of the Privacy Act and applicable regulations, Plaintiffs have 
been seriously and significantly injured. The damages suffered by Plaintiffs include but are not 
hmited to damaged personal and business reputations, public embarrassment, anxiety and 
physical and emotional upset, loss of business and loss of past, present and future income, and 
adverse legal action. For example, and in no way limiting Plaintiffs' damages. Plaintiff Wright 
was advised by people with whom he has previously done business that they would no longer do 
business with him as long as this matter is unresolved. Plaintiff Gowen has lost business deals 
with banks that would have resulted in millions of dollars of income, and Plaintiff Scarborough 
has been accused of false representations regarding his bonds and the underlying assets and sued 
for over $100,000 in federal district court. The federal suit specifically bases many of its 
allegations on the CAN and CID's investigation of Plaintiffs, and includes a copy of the CAN as 
an exhibit. 

86. As a direct result of Defendants' multiple violations of the Privacy Act, Plaintiffs 
have suffered damages in an amount to be proven at trial but no less than $36,000,000.00. 

COUNT I 

(DA's Violations of the Privacy Act by Disclosing the CAN to NASBP) 

87. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

88. The Privacy Act's central provision preventing disclosure of records is 5 U.S.C. 
§ 552a(b), which states that "[n]o agency shall disclose any record which is contained in a 
system of records by any means of communication to any person, or to another agency, except 
pursuant to a written request by, or with the prior written consent of, the individual to whom the 
record pertains, unless disclosure of the record" falls within one of 12 listed exceptions. 

89. In or about March 2005, Defendant DA, through its agents and representatives 
including but not hmited to SA Hamblen, intentionally and/or willfully disclosed the CAN, and 
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the personal, Privacy Act-protected information contained therein, to the NASBP in violation of 
the Privacy Act, in that no listed exception in 5 U.S.C. § 552a(b) applies. 

90. Defendant DA, through its agents and representatives, intentionally and/or 
willfully made the above disclosure of records maintained in a system of records pertaining to 
the Plaintiffs without any official need, official purpose, or other lawful authority in violating 
5 U.S.C. § 552a(b). Defendant DA had no reason to believe its disclosure was lawful because 
the NASBP is not a government agency or organization, has no need to know such information 
or gain access to such records, and on information and belief disclosure to NASBP is not a 
routine use of the relevant records. 

91. Defendant DA, through its agents and representatives, intentionally and/or 
willfully disclosed and released the contents of the CAN to the NASBP without a valid 
exemption permitting such disclosure under 5 U.S.C. § 552a(b), 5 U.S.C. § 552a(j), or 5 U.S.C. 
§ 552a(k) or Plaintiffs' authorization for release. 

92. From on or about March 2005 to the present. Defendant DA, through its agents 
and representatives in the CID, intentionally and/or willfully violated its own agency regulations, 
procedures and protocols in creating and disseminating the CAN. Absent evidence of an actual 
crime, CID was limited by DA and CID Regulations to referring the matter to the PFD for 
possible issuance of a PFR. CID's intentional and/or willful violation of DA and CID 
Regulations, procedures and protocols is evidence of the willful and/or intentional nature of 
DA's disclosure of Plaintiffs' Privacy Act-protected information. 

93. From on or about March 2005 to the present. Defendant DA, through its agents 
and representatives in the CID, intentionally and/or willfully disseminated the CAN containing 
Privacy Act-protected information (a) to persons whose official duties did not create a definite 
and identifiable need for them to have access, (b) despite the absence of any indication that an 
offense was imminent, (c) to far more individuals than necessary to prevent the commission of 
any offense, (d) to more than just the criminal investigative organization(s) of other military 
components, and (e) in violation of the restrictions against release of FOUO information. These 
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intentional and/or willful violations are further evidence of the willful and/or intentional nature 
of DA's disclosure of Plaintiffs' Privacy Act-protected information. 

94. From April 2005 to present, Defendant DA, through its agents and representatives 
including but not limited to SA Hamblen and Greenway, did continue to intentionally and/or 
willfully violate agency regulations, protocols, and procedures, and the Privacy Act, by 
disclosing personal, confidential information contained in the CAN despite having been put on 
notice by Plaintiffs' counsel of the Privacy Act violations. 

95. In May 2005, Defendant DA, through its agent Greenway, threatened further 
disclosure and dissemination of Privacy Act-protected information about Plaintiffs in response to 
Plaintiffs' counsel's notification of the Privacy Act violations, and providing evidence that no 
fraud or crime is or was being committed. Greenway 's threat further evidences the willful and/or 
intentional and malicious nature of DoD's Privacy Act violations. 

96. Plaintiffs did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendant DA in a 
system of records pertaining to the Plaintiffs. 

97. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA the Plaintiffs suffered an adverse effect as defined in 5 U.S.C. 

§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

98. Defendant DA is liable to Plaintiffs for all direct and proximate adverse effects 
and damages, of whatever kind, resulting from its intentional and/or willful violation of the 
Privacy Act in disclosing and disseminating the CAN to NASBP. 
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COUNT II 

(DA's Violations of the Privacy Act by SA Hamblen's June 21, 2005 Letter to First Bank) 

99. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

100. The Privacy Act' s central provision preventing disclosure of records is 5 U.S.C. 
§ 552a(b), which states that "[n]o agency shall disclose any record which is contained in a 
system of records by any means of communication to any person, or to another agency, except 
pursuant to a written request by, or with the prior written consent of, the individual to whom the 
record pertains, unless disclosure of the record" falls within one of 12 listed exceptions. 

101. In or about June 2005, Defendant DA, through its agent SA Hamblen, 
intentionally and/or willfully disclosed the Privacy Act-protected information by means of 

SA Hamblen's June 21, 2005 letter to First Bank in violation of the Privacy Act, in that no listed 
exception in 5 U.S.C. § 552a(b) applies. 

102. Defendant DA, through its agent and representative, intentionally and/or willfully 
made the above disclosure of records maintained in a system of records pertaining to the 
Plaintiffs without any official need, official purpose, or other lawful authority in violating 

5 U.S.C. § 552a(b). 

103. Defendant DA, through its agent and representative, intentionally and/or willfully 
disclosed and released the Privacy Act-protected information in the June 21, 2005 letter to First 
Bank without a valid exemption permitting such disclosure under 5 U.S.C. § 552a(b), 5 U.S.C. 

§ 552a(j), or 5 U.S.C. § 552a(k) or Plaintiffs' authorization for release. 

104. Plaintiffs did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendant DA in a 
system of records pertaining to the Plaintiffs. 

105. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA the Plaintiffs suffered an adverse effect as required by 5 U.S.C. 

§ 552a(g)(l)(D), and suffered actual damages including, but not limited to, actual pecuniary 
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damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

106. Defendant DA is liable to Plaintiffs for all direct and proximate adverse effects 
and damages, of whatever kind, resulting from its intentional and/or willful violation of the 
Privacy Act in disclosing Privacy Act-protected information to First Bank. 

COUNT III 

(DA's Violations of the Privacy Act by Greenway's May 6, 2005 Disclosure of Privacy Act- 
Protected Information about Plaintiff Scarborough to Plaintiff Wright and His Counsel) 

107. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

108. Certain information about Plaintiffs Scarborough maintained by Defendant DA is 
Privacy Act-protected information and a "record" in a system of records maintained by 
Defendant DA. As such, the Privacy Act prohibits disclosure of such information unless some 
exception or exemption under the Act applies. 

109. On or about May 6, 2005, Defendant DA, through its agent and representative 
Greenway, intentionally and/or willfully disclosed Privacy Act-protected information about 
Plaintiff Scarborough to Plaintiff Wright and his counsel in violation of the Privacy Act' s central 
provision preventing such disclosure - 5 U.S.C. § 552a(b). 

110. Greenway' s disclosure of Privacy Act-protected information about Plaintiff 
Scarborough was an intentional and/or willful violation of the Privacy Act, in that no listed 
exception in 5 U.S.C. § 552a(b) applies. 

111. Defendant DA, through its agent and representative Greenway, intentionally 
and/or willfully made the above disclosure of records maintained in a system of records without 
any official need, official purpose, or other lawful authority in violating 5 U.S.C. § 552a(b). 

112. Defendant DA, through its agent and representative Greenway, intentionally 
and/or willfully disclosed Privacy Act-protected information about Plaintiff Scarborough to 
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Plaintiff Wright and his counsel without a valid exemption permitting such disclosure under 
5 U.S.C. § 552a(b), 5 U.S.C. § 552aG), or 5 U.S.C. § 552a(k) or Plaintiffs' authorization for 
release. 

113. Greenway' s unauthorized disclosure of Privacy Act-protected information about 
Plaintiff Scarborough without any need or justification evidences the intentional and/or willful 
and malicious nature of DA's Privacy Act violations. 

1 14. Plaintiff Scarborough did not consent to the release and did nothing to create or 
contribute to the risk of the disclosure and release of the contents of his records maintained by 
Defendant DA in a system of records pertaining to the Plaintiffs. 

115. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA, Plaintiff Scarborough suffered an adverse effect as required by 

5 U.S.C. § 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual 
pecuniary damages and actual non-pecuniary damages in the form of direct and indirect injury to 
the Plaintiffs reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

1 16. Defendant DA is liable to Plaintiff Scarborough for all direct and proximate 
adverse effects and damages, of whatever kind, resulting from its intentional and/or willful 
violation of the Privacy Act in disclosing and disseminating Privacy Act-protected information 
about Plaintiff Scarborough to Plaintiff Wright and his counsel. 

COUNT IV 

(DA's Violations of the Privacy Act by Greenway's May 16, 2005 Disclosure of Privacy Act- 
Protected Information about Plaintiff Wright to Plaintiff Scarborough and His Counsel) 

117. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

118. Certain information about Plaintiff Wright maintained by Defendant DA is 
Privacy Act-protected information and a "record" in a system of records maintained by 
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Defendant DA. As such, the Privacy Act prohibits disclosure of such information unless some 
exception or exemption under the Act applies. 

1 19. On or about May 16, 2005, Defendant DA, through its agent and representative 
Greenway, intentionally and/or willfully disclosed Privacy Act-protected information about 
Plaintiff Wright to Plaintiff Scarborough and his counsel in violation of the Privacy Act's central 
provision preventing such disclosure - 5 U.S.C. § 552a(b). 

120. Greenway' s disclosure of Privacy Act-protected information about Plaintiff 
Wright was an intentional and/or willful violation of the Privacy Act, in that no listed exception 
in 5 U.S.C. § 552a(b) applies. 

121. Defendant DA, through its agent and representative Greenway, intentionally 
and/or willfully made the above disclosure of records maintained in a system of records without 
any official need, official purpose, or other lawful authority in violating 5 U.S.C. § 552a(b). 

122. Defendant DA, through its agent and representative Greenway, intentionally 
and/or willfully disclosed Privacy Act-protected information about Plaintiff Wright to Plaintiff 
Scarborough and his counsel without a valid exemption permitting such disclosure under 

5 U.S.C. § 552a(b), 5 U.S.C. § 552aG), or 5 U.S.C. § 552a(k) or Plaintiffs' authorization for 
release. 

123. Greenway' s unauthorized disclosure of Privacy Act-protected information about 
Plaintiff Wright without any need or justification evidences the intentional and/or willful and 
malicious nature of DA's Privacy Act violations. 

124. Plaintiff Wright did not consent to the release and did nothing to create or 
contribute to the risk of the disclosure and release of the contents of his records maintained by 
Defendant DA in a system of records pertaining to the Plaintiffs. 

125. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA, Plaintiff Wright suffered an adverse effect as required by 

5 U.S.C. § 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual 
pecuniary damages and actual non-pecuniary damages in the form of direct and indirect injury to 
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the Plaintiffs reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

126. Defendant DA is liable to Plaintiff Wright for all direct and proximate adverse 
effects and damages, of whatever kind, resulting from its intentional and/or willful violation of 
the Privacy Act in disclosing and disseminating Privacy Act-protected information about 
Plaintiff Wright to Plaintiff Scarborough and his counsel. 

COUNT V 

(The DA's Violations of the Privacy Act by Disclosing the CAN to DAU) 

127. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

128. In or about March 2005, Defendant DA, through its agents and representatives 
including but not hmited to SA Hamblen, intentionally and/or willfully disclosed the CAN, and 
the personal Privacy Act-protected information contained therein, to the DoD's DAU in violation 
of the Privacy Act's central provision preventing such disclosure 5 U.S.C. § 552a(b). 

129. In or about March 2005, Defendant DA, through its agents and representatives, 
intentionally and/or willfully made the above disclosures of records maintained in a system of 
records pertaining to the Plaintiffs without any official need, official purpose, or other lawful 
authority in violating 5 U.S.C. § 552a(b). 

130. In or about March 2005, Defendant DA intentionally and/or willfully disclosed 
the CAN, and the personal information contained therein, to the DAU without any relevant or 
necessary purpose required or permitted by law. Further, Defendant DA's disclosure was not 
conducted on a "need to know" basis pursuant to 5 U.S.C. § 552a(b)(l). 

131. From March 2005 to present. Defendant DA has regularly, flagrantly, and 
egregiously violated regulations, procedures, and protocols as noted above and, therefore, acted 
in an intentional and/or willful manner with the knowledge that the disclosure to the DAU 
constituted a violation of the Privacy Act. 



27 



Case 1 :05-cv-01 427-RBW Document 1 0-2 Filed 1 2/05/2005 Page 28 of 49 



132. Plaintiff did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendant DA in a 
system of records pertaining to Plaintiffs. 

133. As a direct and proximate result of the above-referenced actions by Defendant 
DA, intentional and/or willful disclosures and release of the contents of records maintained by 
Defendant DA in a system of records pertaining to the Plaintiffs occurred and sensitive personal 
information about the Plaintiffs labeled FOUO was released to the DAU. Such disclosure and 
release by Defendant DA without Plaintiffs' authorization and without appropriate statutory 
exemption constituted a violation of Plaintiffs' personal right to privacy under the Privacy Act of 
1974, as amended, and were the direct and proximate cause of the actual damages described 
below. 

134. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA, the Plaintiffs suffered an "adverse effect," as defined in 5 U.S.C. 
§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

COUNT VI 

(The DA's Violations of the Privacy Act by Disclosing the CAN to Other DoD Agencies) 

135. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

136. In or about March 2005, Defendant DA, through its agents and representatives 
including but not Umited to SA Hamblen, intentionally and/or willfully disclosed the CAN, and 
the personal information contained therein, to all DoD agencies' contracting offices in violation 
of the Privacy Act's central provision preventing such disclosure 5 U.S.C. § 552a(b). 

137. In or about March 2005, Defendant DA, through its agents and representatives, 
intentionally and/or willfully made the above disclosures of records maintained in a system of 
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records pertaining to the Plaintiffs without any official need, official purpose, or other lawful 
authority in violating 5 U.S.C. § 552a(b). 

138. The Privacy Act, 5 U.S.C. § 552a(b)(3), also provides that Privacy Act-protected 
information may be disclosed to another Government agency for a "routine use" as defined in the 
Act but only if certain system requirements have been met. 

139. In or about March 2005, Defendant DA intentionally and/or willfully disclosed 
the CAN, and the personal information contained therein, to all DoD contracting offices without 
any relevant purpose required or permitted by law. Defendant DA's disclosure was not 
conducted on a "need to know" basis pursuant to 5 U.S.C. § 552a(b)(l). Alternatively, the 
DoD's disclosure was not for a "routine use" under 5 U.S.C. § 552a(a)(7), (b)(3), or (e)(4)(D). 

140. From March 2005 to present. Defendant DA has regularly, flagrantly, and 
egregiously violated regulations, procedures, and protocols as noted above and, therefore, acted 
in an intentional and/or willful manner with the knowledge that the disclosure to all DoD 
contracting offices constituted a violation of the Privacy Act. 

141. Plaintiff did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendant DA in a 
system of records pertaining to Plaintiffs. 

142. As a direct and proximate result of the above-referenced actions by Defendant 
DA, intentional and/or willful disclosures and release of the contents of records maintained by 
Defendant DA in a system of records pertaining to the Plaintiffs occurred and sensitive personal 
information about the Plaintiffs labeled FOUO was released to all DoD contracting offices. Such 
disclosure and release by Defendant DA without Plaintiffs' authorization and without 
appropriate statutory exemption constituted a violation of Plaintiffs' personal right to privacy 
under the Privacy Act of 1974, as amended, and were the direct and proximate cause of the 
actual damages described below. 

143. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA, the Plaintiffs suffered an "adverse effect," as defined in 5 U.S.C. 
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§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

COUNT VII 
(DA's Violations of the Privacy Act's Provisions at 5 U.S.C. § 552a(e)(6)) 

144. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

145. The Privacy Act, at 5 U.S.C. § 552a(e)(6), requires that each agency maintaining 
a system of records shall "prior to disseminating any record about an individual to any person 
other than an agency, unless dissemination is made pursuant to (b)(2) of [§ 552a], make 
reasonable efforts to assure that such records are accurate, complete, timely, and relevant for 
agency purposes." 

146. In or about March 2005 Defendant DA, through its agent SA Hamblen, 
intentionally and/or willfully failed to make reasonable efforts to assure that the CAN and any 
related reports of his investigation were accurate, complete, timely, and relevant for CID's or 
DoD's purposes prior to disseminating the CAN, which is or is part of a system of records, to 
NASBP. 

147. Absent evidence of an actual crime, CID was limited by DA and CID Regulations 
to issuing a CIR or PFR. CID's intentional and/or willful violation of DA and CID Regulations, 
procedures and protocols is evidence of the intentional and/or willful nature of DoD's disclosure 
of Plaintiffs' Privacy Act-protected information. 

148. The CAN and related reports of SA Hamblen's investigation were not accurate, 
complete, timely and/or relevant in that they include numerous factual inaccuracies including, 
but not limited to, the description of the events and circumstances surrounding Request for 
Proposal W912DS-04-B-0008, description of the events and circumstances surrounding Request 
for Proposal W912DS-04-R-0018, categorization of CID's investigation of Wright "for the same 
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activity as identified in this alert," assertion that FAR 28.203 lists ITR as unacceptable assets, 
failure to note that multiple previous government procurement contracts have been supported by 
individual surety bonds backed by ITRs, implication that the assets supporting the bonds issued 
by Plaintiffs were false or fictitious, and failure to recognize that UG has never issued or backed 
individual surety bonds. 

149. Defendant DA, through its agents and representatives, intentionally and/or 
willfully disclosed and released the contents of records maintained in a system of records 
pertaining to the Plaintiffs without advance consent and without providing Plaintiffs any prior 
notice or an opportunity to protest the disclosure, so that the Plaintiffs had no opportunity to 
protect certain personal information or petition for amendment of various false and misleading 
statements before unlawful disclosure to the industry competitors, unauthorized agencies, 
unauthorized DoD personnel, and the general public. 

150. From March 2005 to present. Defendant DA, through its agents and 
representatives, intentionally and/or willfully disclosed and released the contents of records 
maintained in a system of records pertaining to the Plaintiffs without making any reasonable 
efforts to assure that the information contained within the records were "accurate, complete, 
timely, and relevant for agency purposes," in violation of 5 U.S.C. § 552a(e)(6), as evidenced by 
Defendant DA's repeated, flagrant, and egregious violation of regulations, procedures and 
protocols in connection with the creation and the dissemination of the CAN. 

151. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA the Plaintiffs suffered an "adverse effect," as defined in 5 U.S.C. 
§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 
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COUNT VIII 
(DA'S Violations of the Privacy Act's Provisions at 5 U.S.C. § 552a(e)(9)) 

152. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

153. The Privacy Act, at 5 U.S.C. § 552a(e)(9), requires that each agency maintaining 
a system of records shall "establish rules of conduct for persons involved in the design, 
development, operation, or maintenance of any system of records, or in maintaining any record, 
and instruct each such person with respect to such rules and the requirements of this section, 
including any other rules and procedures adopted pursuant to this section and the penalties of 
noncompliance." 

154. Defendant DA, as evidenced by the repeated, flagrant and egregious breaches of 
regulations, procedures, and protocols did not establish rules of conduct for persons involved in 
the design, development, operation, or maintenance of the system of records, and did not instruct 
each person with respect to such rules or the penalties of noncompliance, allowing its agents and 
representatives to harm, embarrass, and inconvenience Plaintiffs. 

155. Defendant DA, through its agents and representatives, intentionally and/or 
willfully and repeatedly e-mailed the CAN, and the personal information contained within the 
CAN, to unauthorized parties as outlined above, despite the clear indication that the information 
contained therein was FOUO. These unlawful activities evidence that Defendant DA did not 
establish rules of conduct for persons involved in the design, development, operation, or 
maintenance of the system of records, and did not instruct each person with respect to such rules 
or the penalties of noncompliance, and instead allowed various DoD agents and representatives 
to e-mail and disclose Privacy Act-protected information labeled FOUO to unauthorized 
agencies, unauthorized contractors, unauthorized agents or representatives of DAU, unauthorized 
agents or representatives of competitors to Plaintiffs, and unauthorized third parties. 

156. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DA, the Plaintiffs suffered an "adverse effect," as defined in 5 U.S.C. 
§ 552a(g)(l)(D), and suffered actual damages including, but not limited to, actual pecuniary 
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damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

COUNT IX 
(DA'S Violations of the Privacy Act's Provisions at 5 U.S.C. § 552a(e)(10)) 

157. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

158. The Privacy Act, at 5 U.S.C. § 552a(e)(10), requires that each agency maintaining 
a system of records shall "establish appropriate administrative, technical, and physical 
safeguards to insure the security and confidentiality of records and to protect against any 
anticipated threats or hazards to their security or integrity which could result in substantial harm, 
embarrassment, inconvenience, or unfairness to any individual on whom information is 
maintained." 

159. Defendant DA, due to its repeated, flagrant and egregious breaches of regulations, 
procedures and protocols did not establish appropriate administrative, technical, and physical 
safeguards to ensure the security and confidentiality of records, allowing its agents or 
representatives to harm, embarrass, and inconvenience Plaintiffs. 

160. Defendant DA, through its agents and representatives, intentionally and/or 
willfully and repeatedly e-mailed the CAN, and the personal information contained within the 
CAN, to unauthorized parties as outlined above, despite the clear indication that the information 
contained therein was FOUO. These unlawful activities indicate Defendant DA did not establish 
appropriate administrative, technical, and physical safeguards to insure the security and 
confidentiality of records, allowing its agents or representatives to harm, embarrass, and 
inconvenience Plaintiffs on whom the information in the records was maintained. 

161. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DoD, the Plaintiffs suffered an "adverse effect," as defined in 

5 U.S.C. § 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual 
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pecuniary damages and actual non-pecuniary damages in the form of direct and indirect injury to 
the Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

COUNT X 

(DoD's Violations of the Privacy Act by Disclosing the 
CAN to the Public by Means of the DAU Website) 

162. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

163. In or about March 2005, Defendant DoD, through its agents and representatives 
including personnel at DAU, intentionally and/or willfully disclosed the CAN, and the personal. 
Privacy Act-protected information contained therein, to the public in violation of the Privacy 
Act's central provision preventing such disclosure - 5 U.S.C. § 552a(b). 

164. Defendant DoD, through its agents and representatives including personnel at 
DAU, intentionally and/or willfully made the above disclosures of records maintained in a 
system of records pertaining to the Plaintiffs without any official need, official purpose, or other 
lawful authority in violating 5 U.S.C. § 552a(b). 

165. Further, Defendant DoD's disclosure was not conducted on a "need to know" 
basis pursuant to 5 U.S.C. § 552a(b)(l). 

166. Defendant DoD, through its agents and representatives including personnel at 
DAU, intentionally and/or willfully disclosed and released the contents of the CAN to the public 
without a valid exemption permitting such disclosure under 5 U.S.C. § 552a(b), 5 U.S.C. 

§ 552a(j), nor 5 U.S.C. § 552a(k) or Plaintiffs' authorization for release. 

167. Defendant DoD, through its agents and representatives including personnel at 
DAU, intentionally and/or willfully violated its own regulations, procedures and protocols in 
creating and disseminating the CAN, and this is evidence of the intentional and/or willful nature 
of Defendant DoD's violation. 
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168. Defendant DoD elected to place the CAN on the public portion of its DAU 
website rather than a password-protected portion, and this is further evidence of the intentional 
and/or willful nature of Defendant DoD's violation. 

169. Plaintiffs did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendant DoD in 
a system of records pertaining to the Plaintiffs. 

170. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DoD the Plaintiffs suffered an "adverse effect" as defined in 5 U.S.C. 
§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

171. Defendant DoD is liable to Plaintiffs for all direct and proximate adverse effects 
and damages, of whatever kind, resulting from its intentional and/or willful violation of the 
Privacy Act in disclosing and disseminating the CAN to the public. 

COUNT XI 

(DoD's Violations of the Privacy Act by Disclosing the CAN to Defendant SBA) 

172. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

173. The Privacy Act, 5 U.S.C. § 552a(b)(3), provides that Privacy Act-protected 
information may be disclosed to another Government agency for a "routine use" as defined in the 
Act and only if certain system requirements have been met. 

174. In or about March 2005, Defendant DoD intentionally and/or willfully disclosed 
the CAN, and the personal information contained therein, to Defendant SBA without any 
relevant purpose required or permitted by law. The DoD's disclosure was not for a "routine use" 
under 5 U.S.C. § 552a(a)(7), (b)(3), or (e)(4)(D). 
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175. Plaintiffs did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendants DoD in 
a system of records pertaining to Plaintiffs. 

176. As a direct and proximate result of the above-referenced actions by Defendant 
DoD, intentional and/or willful disclosures and release of the contents of records maintained by 
Defendant DoD in a system of records pertaining to the Plaintiffs occurred and sensitive personal 
information about the Plaintiffs labeled FOUO was released to the SBA. Such disclosure and 
release by Defendant DoD without Plaintiff's authorization and without appropriate statutory 
exemption constituted a violation of Plaintiff s personal right to privacy under the Privacy Act of 
1974, as amended. 

177. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DoD the Plaintiffs suffered an "adverse effect" as defined in 5 U.S.C. 
§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

178. Defendant DoD is liable to Plaintiffs for all direct and proximate adverse effects 
and damages, of whatever kind, resulting from its intentional and/or willful violation of the 
Privacy Act in disclosing and disseminating the CAN to SBA without authority. 

COUNT XII 

(DoD's Violations of the Privacy Act by Disclosing the 
CAN to Other Government Agencies and Employees) 

179. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

180. In and after March 2005, Defendant DoD, through its agents and representatives, 
including but not limited to Lt Col Feck, intentionally and/or willfully disclosed the CAN, and 
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the personal information contained therein to other Government agencies and employees in 
violation of the Privacy Act's central provision preventing such disclosure 5 U.S.C. § 552a(b). 

181. In or about March 2005, Defendant DoD, through its agents and representatives, 
intentionally and/or willfully made the above disclosures of records maintained in a system of 
records pertaining to the Plaintiffs without any official need, official purpose, or other lawful 
authority in violating 5 U.S.C. § 552a(b). 

182. The Privacy Act, 5 U.S.C. § 552a(b)(3), also provides that Privacy Act-protected 
information may be disclosed to another Government agency for a "routine use" as defined in the 
Act but only if certain system requirements have been met. 

183. In and after March 2005, Defendant DoD intentionally and/or willfully disclosed 
the CAN, and the personal information contained therein, to other Government agencies and 
employees without any relevant purpose required or permitted by law. Defendant DoD's 
disclosure was not conducted on a "need to know" basis pursuant to 5 U.S.C. § 552a(b)(l). 
Alternatively, the DoD's disclosure was not for a "routine use" under 5 U.S.C. § 552a(a)(7), 
(b)(3), or (e)(4)(D). 

184. From March 2005 to present. Defendant DoD has regularly, flagrantly, and 
egregiously violated regulations, procedures, and protocols as noted above and, therefore, acted 
in an intentional and/or willful manner with the knowledge that the disclosure to other 
Government agencies and employees constituted a violation of the Privacy Act. 

185. Plaintiff did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendant DoD in 
a system of records pertaining to Plaintiffs. 

186. As a direct and proximate result of the above-referenced actions by Defendant 
DoD, intentional and/or willful disclosures and release of the contents of records maintained by 
Defendant DoD in a system of records pertaining to the Plaintiffs occurred and sensitive personal 
information about the Plaintiffs labeled FOUO was released to other Government agencies and 
employees. Such disclosure and release by Defendant DoD without Plaintiffs' authorization and 
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without appropriate statutory exemption constituted a violation of Plaintiffs' personal right to 
privacy under the Privacy Act of 1974, as amended, and were the direct and proximate cause of 
the actual damages described below. 

187. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant DoD, the Plaintiffs suffered an "adverse effect," as defined in 

5 U.S.C. § 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual 
pecuniary damages and actual non-pecuniary damages in the form of direct and indirect injury to 
the Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

COUNT XIII 
(SBA's Violations of the Privacy Act by Disclosing the CAN to the Public) 

188. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

189. The Privacy Act, at 5 U.S.C. § 552a(b)(l), requires that no agency shall disclose 
any record contained in a system of records by any means of communication to any person, or to 
another agency, without prior written consent, "unless disclosure of the record would be - (1) to 
those officers and employees of the agency which maintains the record who have a need for the 
record in the performance of their duties". 

190. From March 31, 2005 through the present, the SBA's intentional and willful 
disclosure of the CAN clearly marked FOUO, through its agents and representatives including 
but not limited to Montes and Guerra, to parties outside the SBA was not relevant or necessary to 
accomplish any purpose required or permitted by law and was in violation of the Privacy Act. 

191. On or about April 1, 2005, Defendant SBA's intentional and willful intra-agency 
disclosure of the CAN, through its agents and representatives, to various members of the SBA 
was not relevant or necessary to accomplish any purpose required or permitted by law, was not 
conducted on a "need to know" basis pursuant to 5 U.S.C. § 552a(b)(l), and was in violation of 
the Privacy Act. 
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192. From March through the end of June 2005, Defendant SBA, through its agents 
and representatives, intentionally and willfully disclosed the CAN, and the personal information 
contained therein, to private citizens and business entities outside the Government, including 
Plaintiffs' competitors, contractors, and unauthorized third parties without any official need or 
purpose, or other lawful authority. Upon information and belief. Defendant SBA also failed to 
make an independent inquiry into the CAN or the facts therein to ensure it was correct before 
disseminating it. 

193. Plaintiffs did not consent to the release and did nothing to create or contribute to 
the risk of the disclosure and release of the contents of records maintained by Defendant SBA in 
a system of records pertaining to the Plaintiffs. 

194. As a direct and proximate result of the above-referenced actions by Defendant 
SBA, intentional and willful disclosures and release of the contents of records maintained in a 
system of records pertaining to the Plaintiffs or, alternatively, derived from a system of records 
maintained by another agency, occurred and sensitive personal information about the Plaintiffs 
labeled FOUO was released to Plaintiffs' competitors, contractors and various unauthorized third 
parties. Such disclosure and release by Defendant SBA without Plaintiffs' authorization and 
without appropriate statutory exemption constituted a violation of Plaintiffs' personal right to 
privacy under the Privacy Act of 1974, as amended. 

195. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant SBA the Plaintiffs suffered an "adverse effect," as defined in 5 U.S.C. 
§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

196. Defendant SBA is liable to Plaintiffs for all direct and proximate adverse effects 
and damages, of whatever kind, resulting from its intentional and/or willful violation of the 
Privacy Act in disclosing and disseminating the CAN to the public. 
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COUNT XIV 
(SBA's Violations of the Privacy Act's Provisions at 5 U.S.C. § 552a(e)(6)) 

197. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

198. The Privacy Act, at 5 U.S.C. § 552a(e)(6), requires that each agency maintaining 
a system of records shall "prior to disseminating any record about an individual to any person 
other than an agency, unless dissemination is made pursuant to (b)(2) of [§ 552a], make 
reasonable efforts to assure that such records are accurate, complete, timely, and relevant for 
agency purposes." 

199. In or about March 2005 Defendant SBA intentionally and/or willfully failed to 
make reasonable efforts to assure that the CAN and any related reports of investigation were 
accurate, complete, timely, and relevant for SBA's or any other agency's purposes prior to 
disseminating the CAN, which is or is part of a system of records or, alternatively, derived from 
another agency's system of records, to members of the public. 

200. The CAN and related reports of SA Hamblen's investigation were not accurate, 
complete, timely and/or relevant in that they include numerous factual inaccuracies, including 
but not limited to the description of the events and circumstances surrounding Request for 
Proposal W912DS-04-B-0008, description of the events and circumstances surrounding Request 
for Proposal W912DS-04-R-00 18, categorization of CID's investigation of Wright "for the same 
activity as identified in this alert," assertion that FAR 28.203 lists ITR as unacceptable assets, 
failure to note that multiple previous government procurement contracts have been supported by 
individual surety bonds backed by ITRs, implication that the assets supporting the bonds issued 
by Plaintiffs were false or fictitious, and failure to recognize that UG has never issued or backed 
individual surety bonds. 

201. Defendant SBA, through its agents and representatives, intentionally and/or 
willfully disclosed and released the contents of records maintained in a system of records 
pertaining to the Plaintiffs or, alternatively, derived from another agency's system of records 
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pertaining to the Plaintiffs, without advance consent and without providing Plaintiffs any prior 
notice or an opportunity to protest the disclosure, so that the Plaintiffs had no opportunity to 
protect certain personal information or petition for amendment of various false and misleading 
statements before unlawful disclosure to the industry competitors, unauthorized agencies, 
unauthorized DoD and other Government personnel, and the general public. 

202. From March 2005 to present. Defendant SBA, through its agents and 
representatives, intentionally and/or willfully disclosed and released the contents of records 
maintained in a system of records pertaining to the Plaintiffs or, alternatively, derived from 
another agency's system of records pertaining to the Plaintiffs, without making any reasonable 
efforts to assure that the information contained within the records were "accurate, complete, 
timely, and relevant for agency purposes," in violation of 5 U.S.C. § 552a(e)(6), as evidenced by 
Defendant SBA's violations of regulations, procedures and protocols in connection with the 
creation and the dissemination of Privacy Act-protected information. 

203. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant SBA the Plaintiffs suffered an "adverse effect," as defined in 5 U.S.C. 
§ 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual pecuniary 
damages and actual non-pecuniary damages in the form of direct and indirect injury to the 
Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

COUNT XV 
(SBA's Violations of the Privacy Act's Provisions at 5 U.S.C. § 552a(e)(9)) 

204. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 

205. The Privacy Act, at 5 U.S.C. § 552a(e)(9), requires that each agency maintaining 
a system of records shall "establish rules of conduct for persons involved in the design, 
development, operation, or maintenance of any system of records, or in maintaining any record, 
and instruct each such person with respect to such rules and the requirements of this section. 
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including any other rules and procedures adopted pursuant to this section and the penalties of 
noncompliance." 

206. Defendant SB A, as evidenced by the repeated, flagrant and egregious breaches of 
regulations, procedures, and protocols did not establish rules of conduct for persons involved in 
the design, development, operation, or maintenance of the system of records, and did not instruct 
each person with respect to such rules or the penalties of noncompliance, allowing its agents and 
representatives to harm, embarrass, and inconvenience Plaintiffs. 

207. Defendant SB A, through its agents and representatives, intentionally and/or 
willfully and repeatedly e-mailed the CAN, and the personal information contained within the 
CAN, to unauthorized parties as outlined above, despite the clear indication that the information 
contained therein was FOUO. These unlawful activities evidence that Defendant SBA did not 
establish rules of conduct for persons involved in the design, development, operation, or 
maintenance of the system of records, and did not instruct each person with respect to such rules 
or the penalties of noncompliance, and instead allowed various SBA agents and representatives 
to e-mail and disclose Privacy Act-protected information labeled FOUO to unauthorized third 
parties. 

208. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant SBA, the Plaintiffs suffered an "adverse effect," as defined in 

5 U.S.C. § 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual 
pecuniary damages and actual non-pecuniary damages in the form of direct and indirect injury to 
the Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

COUNT XVI 
(SBA's Violations of the Privacy Act's Provisions at 5 U.S.C. § 552a(e)(10)) 

209. Paragraphs 1 through 86 are incorporated as though fully set forth herein. 
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210. The Privacy Act, at 5 U.S.C. § 552a(e)( 10), requires that each agency maintaining 
a system of records shall "establish appropriate administrative, technical, and physical 
safeguards to insure the security and confidentiality of records and to protect against any 
anticipated threats or hazards to their security or integrity which could result in substantial harm, 
embarrassment, inconvenience, or unfairness to any individual on whom information is 
maintained." 

211. Defendant SB A, due to its repeated, flagrant and egregious breaches of 
regulations, procedures and protocols did not establish appropriate administrative, technical, and 
physical safeguards to ensure the security and confidentiality of records, allowing its agents or 
representatives to harm, embarrass, and inconvenience Plaintiffs. 

212. Defendant SBA, through its agents and representatives, intentionally and/or 
willfully and repeatedly e-mailed the CAN, and the personal information contained within the 
CAN, to unauthorized parties as outlined above, despite the clear indication that the information 
contained therein was FOUO. These unlawful activities indicate Defendant SBA did not 
establish appropriate administrative, technical, and physical safeguards to insure the security and 
confidentiality of records, allowing its agents or representatives to harm, embarrass, and 
inconvenience Plaintiffs on whom the information in the records was maintained. 

213. As a direct and proximate result of the above-referenced violations of the Privacy 
Act of 1974 by Defendant SBA, the Plaintiffs suffered an "adverse effect," as defined in 

5 U.S.C. § 552a(g)(l)(D), and suffered actual damages, including but not limited to, actual 
pecuniary damages and actual non-pecuniary damages in the form of direct and indirect injury to 
the Plaintiffs' reputations, loss of business, loss of future investment backed expectations, and 
extreme public embarrassment, humiliation and mental anguish. 

WHEREFORE, Plaintiffs Edmund C. Scarborough, Dr. Larry J. Wright and George 
Gowen respectfully pray: 
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i. For judgment in favor of all Plaintiffs and against Defendant Department of the 
Army on Count I of Plaintiffs' Complaint in an amount to be proven at trial but 
not less than $36,000,000.00 for violating the Privacy Act in disclosing the 
CAN to the National Association of Surety Bond Producers; 

ii. For judgment in favor of all Plaintiffs and against Defendant Department of the 
Army on Count II of Plaintiffs' Complaint in an amount to be proven at trial but 
not less than $36,000,000.00 for violating the Privacy Act by SA Hamblen's 
June 21, 2005 letter to First Bank; 

iii. For judgment in favor of Plaintiff Scarborough and against Defendant 

Department of the Army on Count III of Plaintiffs' Complaint in an amount to 
be proven at trial but not less than $36,000,000.00 for violating the Privacy Act 
by Curtis L. Greenway's disclosure of Privacy Act-protected information about 
Plaintiff Scarborough to Plaintiff Wright and his counsel; 

iv. For judgment in favor of Plaintiff Wright and against Defendant Department of 
the Army on Count IV of Plaintiffs' Complaint in an amount to be proven at 
trial but not less than $36,000,000.00 for violating the Privacy Act by Curtis L. 
Greenway's disclosure of Privacy Act-protected information about Plaintiff 
Wright to Plaintiff Scarborough and his counsel; 

V. For judgment in favor of all Plaintiffs and against Defendant Department of the 
Army on Count V of Plaintiffs' Complaint in an amount to be proven at trial but 
not less than $36,000,000.00 for violating the Privacy Act by disclosing the 
CAN to the Defense Acquisition University; 
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vi. For judgment in favor of all Plaintiffs and against Defendant Department of the 
Army on Count VI of Plaintiffs' Complaint in an amount to be proven at trial 
but not less than $36,000,000.00 for violating the Privacy Act by disclosing the 
CAN to other DoD agencies; 

vii. For judgment in favor of all Plaintiffs and against Defendant Department of the 
Army on Count VII of Plaintiffs' Complaint in an amount to be proven at trial 
but not less than $36,000,000.00 for violating the Privacy Act by failing to 
follow the requirements of 5 U.S.C. § 552a(e)(6); 
viii. For judgment in favor of all Plaintiffs and against Defendant Department of the 
Army on Count VIII of Plaintiffs' Complaint in an amount to be proven at trial 
but not less than $36,000,000.00 for violating the Privacy Act by failing to 
follow the requirements of 5 U.S.C. § 552a(e)(9); 

ix. For judgment in favor of all Plaintiffs and against Defendant Department of the 
Army on Count IX of Plaintiffs' Complaint in an amount to be proven at trial 
but not less than $36,000,000.00 for violating the Privacy Act by failing to 
follow the requirements of 5 U.S.C. § 552a(e)(10); 

X. For judgment in favor of all Plaintiffs and against Defendant Department of 
Defense on Count X of Plaintiffs' Complaint in an amount to be proven at trial 
but not less than $36,000,000.00 for violating the Privacy Act by disclosing the 
CAN to the public by means of the DAU website; 

xi. For judgment in favor of all Plaintiffs and against Defendant Department of 
Defense on Count XI of Plaintiffs' Complaint in an amount to be proven at trial 
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but not less than $36,000,000.00 for violating the Privacy Act by disclosing the 

CAN to Defendant SBA; 
xii. For judgment in favor of all Plaintiffs and against Defendant Department of 

Defense on Count XII of Plaintiffs' Complaint in an amount to be proven at trial 

but not less than $36,000,000.00 for violating the Privacy Act by disclosing the 

CAN to other Government agencies and employees; 
xiii. For judgment in favor of all Plaintiffs and against Defendant United States 

Small Business Administration on Count XIII of Plaintiffs' Complaint in an 

amount to be proven at trial for violating the Privacy Act by disclosing the CAN 

to the public; 
xiv. For judgment in favor of all Plaintiffs and against Defendant United States 

Small Business Administration on Count XIV of Plaintiffs' Complaint in an 

amount to be proven at trial for violating the Privacy Act by failing to follow the 

requirements of 5 U.S.C. § 552a(e)(6); 
XV. For judgment in favor of all Plaintiffs and against Defendant United States 

Small Business Administration on Count XV of Plaintiffs' Complaint in an 

amount to be proven at trial for violating the Privacy Act by failing to follow the 

requirements of 5 U.S.C. § 552a(e)(9); and 
xvi. For judgment in favor of all Plaintiffs and against Defendant United States 

Small Business Administration on Count XVI of Plaintiffs' Complaint in an 

amount to be proven at trial for violating the Privacy Act by failing to follow the 

requirements of 5 U.S.C. § 552a(e)(10). 
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xvii. For such other and further relief as this Court may deem just and proper, 
together with costs, attorneys' fees and expenses allowable under the law. 

December 5, 2005 Respectfully submitted. 
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AO 440 (Rev. 8/01) Summons in a Civil Action 



United States District Court 

District of Columbia 



EDMUND C. SCARBOROUGH, 
DR. LARRY J. WRIGHT, 
GEORGE GOWEN 



SUMMONS IN A CIVIL CASE 



Francis J. Harvey, Secretary of the Army, UNITED 
STATES DEPARTMENT OF THE ARMY 



Donald H. Rumsfeld, Secretary of Defense, UNITED 
STATES DEPARTMENT OF DEFENSE 



CASE NUMBER: 



Hector V. Barreto, Administrator, 
UNITED STATES SMALL 
BUSINESS ADMINISTRATION 



IvJl (Name and address of Defendant) 

Hector V. Barreto, Administrator 

United States Small Business 

Administration □ 

Serve: United States Small Business Administration 
Office of the General Counsel 409 Third Street S.W. 
Washington, DC 2041 6, 

YOU ARE HEREBY SUMMONED and required to serve on PLAINTIFF'S ATTORNEY (name and address) 

Laurence Schor, Esquire 
Geoffrey T. Keating, Esquire 
McManus, Schor, Asmar & Darden, LLP 
1155 Fifteenth Street, N.W., Suite 900 
Washington, D.C. 20005 



an answer to the complaint which is served on you with this summons, within days after service 

of this summons on you, exclusive of the day of service. If you fail to do so, judgment by default will be taken against you for 
the relief demanded in the complaint. Any answer that you serve on the parties to this action must be filed with the Clerk of this 
Court within a reasonable period of time after service. 



CLERK 



DATE 



(By) DEPUTY CLERK 
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RETURN OF SERVICE 



Service of the Summons and complaint was made by me" 



DATE 



NAME OF SERVER (PRINT) 



TITLE 



Check one box below to indicate appropriate method of service 



G Served personally upon the defendant. Place where served: 



G Left copies thereof at the defendant's dwelling house or usual place of abode with a person of suitable age and 
discretion then residing therein. 



Name of person with whom the summons and complaint were left: 
G Returned unexecuted: 



G Other (specify): 



STATEMENT OF SERVICE FEES 



TRAVEL 



SERVICES 



TOTAL 



DECLARATION OF SERVER 



I declare under penalty of perjury under the laws of the United States of America that the foregoing information 
contained in the Return of Service and Statement of Service Fees is true and correct. 



Executed on 



Date 



Signature of Server 



Address of Server 



{!) As to who may serve a summons see Rule 4 of the Federal Rules of Civil Procedure. 



